Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

1 Introduction to Oracle Audit Vault

• 1.1 Overview of Oracle Audit Vault
• 1.2 Oracle Audit Vault Architecture
• 1.3 Oracle Audit Vault Collection Agents and Collectors
• 1.4 Audit Vault Deployment Options
• 1.5 Selecting Sources and Deploying Collectors to Collect Audit Data
  • 1.5.1 Further Considerations for Selecting Oracle Database Collectors
• 1.6 Oracle Audit Vault Audit Event Categories, Attributes, Event Names, and Event IDs
• 1.7 Summary of Oracle Audit Vault Capabilities
• 1.8 Getting Started
• 1.9 Additional Resources

2 Getting Started with Audit Vault

• 2.1 Checking and Setting Environment Variables (Linux and UNIX Platforms)
• 2.2 Registering Oracle Database Sources and Collectors with Audit Vault
• 2.3 Registering SQL Server Database Sources and Collector with Audit Vault
• 2.4 Starting Up Collection Agents and Collectors
  • 2.4.1 Starting Up Collection Agents
  • 2.4.2 Starting Up Oracle Database Collectors
  • 2.4.3 Starting Up a Microsoft SQL Server Database Collector

3 Configuring and Managing Audit Vault

• 3.1 Performing Additional Audit Vault Configuration Tasks
  • 3.1.1 Managing Collection Agents
    • 3.1.1.1 Using the AVCA Command-Line Utility to Drop an Agent
    • 3.1.1.2 Using the Audit Vault Console to Manage Collection Agents
  • 3.1.2 Adding Sources, Altering Source Attributes, and Dropping Sources
    • 3.1.2.1 Adding Sources
    • 3.1.2.2 Altering Source Attributes
    • 3.1.2.3 Dropping Sources
    • 3.1.2.4 Using the Audit Vault Console to Manage Sources
  • 3.1.3 Adding Collectors, Altering Collector Attributes, and Dropping Collectors
    • 3.1.3.1 Adding Collectors
    • 3.1.3.2 Altering Collector Properties and Attributes
    • 3.1.3.3 Dropping Collectors
    • 3.1.3.4 Using the Audit Vault Console to Manage Collectors
  • 3.1.4 Configuring the Data Warehouse Schedule
    • 3.1.4.1 Using the Audit Vault Console to View Warehouse Schedule Information
    • 3.1.4.2 Using the Audit Vault Console to Set Warehouse Schedule
    • 3.1.4.3 Using the AVCA Command-Line Utility to Set the Warehouse Schedule
  • 3.1.5 Globally Disabling and Enabling Alert Settings
  • 3.1.6 Viewing Audit Event Categories
• 3.2 Managing Audit Vault
  • 3.2.1 Managing Audit Vault Server
  • 3.2.2 Managing the Collection Agent OC4J
  • 3.2.3 Starting and Stopping Collection Agents
    • 3.2.3.1 Using the AVCTL Command-line Utility to Manage a Collection Agent
    • 3.2.3.2 Using the Audit Vault Console to Manage Collection Agents
  • 3.2.4 Starting and Stopping Collectors
    • 3.2.4.1 Using the AVCTL Command-line Utility to Manage Collectors
    • 3.2.4.2 Using the Audit Vault Console to Manage Collectors
  • 3.2.5 Refreshing, Loading, and Purging the Data Warehouse
    • 3.2.5.1 Using the AVCA Command-line Utility to Manage the Data Warehouse
    • 3.2.5.2 Using Audit Vault Console to Manage the Data Warehouse
  • 3.2.6 Viewing Audit Vault Errors

4 Administrative Tasks

• 4.1 Monitoring Space Usage on the SYSAUX Tablespace
• 4.2 Monitoring Disk Space Usage Where Archive Logs Are Stored
• 4.3 Monitoring the Flash Recovery Area
• 4.4 Setting Up Oracle Database Sources for Managing Audit Trail Records
  • 4.4.1 Automatically Managing Audit Trail Records on the Oracle Source Database
    • 4.4.1.1 Moving the Database Audit Trail to a Different Tablespace
  • 4.4.2 Purging Audit Trail Records
    • 4.4.2.1 Automatically Purging Audit Trail Records
    • 4.4.2.2 Manually Purging the Audit Trail
    • 4.4.2.3 Setting a Records Batch Size for Database Audit Trail Purge Operations
    • 4.4.2.4 Managing Audit Trail Purge Jobs
    • 4.4.2.5 Configuring Tracing Debug Levels for Purge Operations
  • 4.4.3 Setting the Size of the Operating System Audit Trail
  • 4.4.4 Setting the Age of the Operating System Audit Trail
• 4.5 Setting Up a Collection Agent Listener to Listen to Other Nodes in an Oracle RAC Environment
• 4.6 Making Connectivity to the Source from the Audit Vault Collection Agent More Highly Available in an Oracle RAC Environment
• 4.7 Changing Audit Vault User Passwords on a Regular Basis
• 4.8 Back Up and Recovery of Oracle Audit Vault

5 Managing Audit Vault Security

• 5.1 Oracle Advanced Security – Secure Management Communication
• 5.2 Oracle Advanced Security – Manage User Authentication Metadata
• 5.3 Oracle Database Vault – Protects Oracle Audit Vault
• 5.4 Oracle Database Vault – Provides Strong Access Controls

6 Troubleshooting an Audit Vault System

• 6.1 Location of Audit Vault Server Log and Error Files
• 6.2 Location of Audit Vault Collection Agent Log and Error Files
• 6.3 Troubleshooting Tips
  • 6.3.1 Audit Vault Server
  • 6.3.2 Audit Vault Collection Agent
  • 6.3.3 Audit Vault Collector
  • 6.3.4 Audit Vault Console
  • 6.3.5 Audit Vault in an Oracle Real Application Clusters (Oracle RAC) Environment

A Audit Vault Configuration Assistant (AVCA) Reference

• add_agent
• create_credential
• create_wallet
• deploy_av
• drop_agent
• generate_csr
• help
• import_cert
• redeploy
• remove_cert
• secure_agent
• secure_av
• set_warehouse_retention
• set_warehouse_schedule

B Audit Vault Control (AVCTL) Reference

• -help
• load_warehouse
• purge_warehouse
• refresh_warehouse
• show_agent_status
• show_av_status
• show_collector_status
• show_oc4j_status
• start_agent
• start_av
• start_collector
• start_oc4j
• stop_agent
• stop_av
• stop_collector
• stop_oc4j

C Audit Vault Oracle Database (AVORCLDB) Reference

• avorcldb
• add_collector
• add_source
• alter_collector
• alter_source
• drop_collector
• drop_source
• -help
• setup
• verify

D Audit Vault SQL Server Database (AVMSSQLDB) Reference

• avmssqldb
• add_collector
• add_source
• alter_collector
• alter_source
• drop_collector
• drop_source
• -help
• setup
• verify

E REDO Collector Database Reference

• E.1 Initialization Parameter Recommendations for Audit Sources on Oracle9i Database Release 2 (9.2)
• E.2 Initialization Parameter Recommendations for Audit Sources on Oracle Database 10g Release 1 (10.1)
• E.3 Initialization Parameter Recommendations for Audit Sources on Oracle Database 10g Release 2 (10.2)
• E.4 Initialization Parameter Recommendations for Audit Sources on Oracle Database 11g Release 1 (11.1)

F DBMS_AUDIT_MGMT Data Dictionary Views

• F.1 DBMS_AUDIT_MGMT Data Views
  • F.1.1 DBA_AUDIT_MGMT_CONFIG_PARAMS
  • F.1.2 DBA_AUDIT_MGMT_LAST_ARCH_TS
  • F.1.3 DBA_AUDIT_MGMT_CLEANUP_JOBS
  • F.1.4 DBA_AUDIT_MGMT_CLEAN_EVENTS

G DBMS_AUDIT_MGMT PL/SQL Package

• Using DBMS_AUDIT_MGMT
  • Overview
  • Security Model
  • Constants
  • Views
• Subprogram Groups
  • Audit Trail Management Subprograms
  • Audit Trail Cleanup Subprograms
• Summary of DBMS_AUDIT_MGMT Subprograms
  • CLEAN_AUDIT_TRAIL Procedure
  • CLEAR_AUDIT_TRAIL_PROPERTY Procedure
  • CLEAR_LAST_ARCHIVE_TIMESTAMP Procedure
  • CREATE_PURGE_JOB Procedure
  • DEINIT_CLEANUP Procedure
  • DROP_PURGE_JOB Procedure
  • GET_AUDIT_COMMIT_DELAY Function
  • INIT_CLEANUP Procedure
  • IS_CLEANUP_INITIALIZED Function
  • SET_AUDIT_TRAIL_LOCATION Procedure
  • SET_AUDIT_TRAIL_PROPERTY Procedure
  • SET_DEBUG_LEVEL Procedure
  • SET_LAST_ARCHIVE_TIMESTAMP Procedure
  • SET_PURGE_JOB_INTERVAL Procedure
  • SET_PURGE_JOB_STATUS Procedure

H Audit Vault Error Messages

• H.1 Audit Vault Server Error Messages
  • H.1.1 Generic Error Codes
  • H.1.2 Source and Event Error Codes
  • H.1.3 Collector Error Codes
  • H.1.4 Attribute Definition Error Codes
  • H.1.5 Alert Error Codes
  • H.1.6 Server-Side Audit Service Error Messages
  • H.1.7 Data Warehouse Error Messages
  • H.1.8 Other Audit Vault Policy Error Messages
• H.2 Audit Vault Client Error Messages
  • H.2.1 General Error Messages
  • H.2.2 CSDK Error Messages
  • H.2.3 OSAUD Collector Error Messages
  • H.2.4 DBAUD Collector Error Messages

Glossary

Index